Privacy Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter “GDPR”), Neopharmed Gentili S.p.A. (“the Company”), with registered office at Via S.G. Cottolengo 15, 20143 Milan, as Data Controller, informs potential reporting persons, reported persons, facilitators and any other natural person potentially involved in the management of reports that the processing of personal data may concern various categories of information relating to natural persons, including, at least potentially, special categories of personal data (Article 9 GDPR) and personal data relating to criminal convictions and offences (Article 10 GDPR). The legal bases for processing are compliance with a legal obligation (Article 6(1)(c) GDPR) and, with regard to special categories of data and criminal data, respectively the provisions of Article 9(2)(g) and Article 10, in conjunction with Article 2-octies of Italian Legislative Decree 196/2003.

The identifying data of the reporting person will be visible exclusively to the external specialized company acting as processor pursuant to Article 28 GDPR and to its technological or telecommunications sub-processors, unless the reporting person has given explicit consent. No further cases of disclosure of personal data are envisaged, except in cases where it is necessary to exercise or defend a right of the controller, the processor or third parties. No personal data will be transferred to or stored outside the European Economic Area.

Personal data that are manifestly not useful for the processing of a specific report will not be collected or, if collected accidentally, will be immediately deleted. In any case, data will be retained for no longer than five years from the date of communication of the final outcome of the reporting procedure.

Each data subject is granted the rights provided for in Articles 15 et seq. GDPR, subject to the limitations set out in Article 2-undecies(1)(f) of Legislative Decree 196/2003. Therefore, the rights referred to in the aforementioned Articles cannot be exercised where such exercise may result in an actual and concrete prejudice to the confidentiality of the identity of the reporting person. The right to withdraw previously given consent remains unaffected.

To exercise these rights, you may contact the Data Controller by writing to its postal address or by sending an email to [email protected] or to the Data Protection Officer (DPO) at [email protected].

The data subject also has the right to lodge a complaint with the Data Protection Authority.